Tipped @Jordyqo $1,000 for responsibly disclosing an account access vulnerability
We don't have an official bug bounty program, but we believe those making the industry safer deserve recognition
Big thanks to Jordyqo and everyone helping make Maxxed safer
On 7 Oct 2026, @maxxed_io went live. I started looking for security vulnerabilities straight away—and the first issue I found was an Account Takeover (ATO) vulnerability, classified as CWE-287 (Improper Authentication). 🧵
After almost a year of building, @maxxedio is finally live
A lot of people on the team have spent countless days and nights getting us here, building everything from scratch with one goal: delivering the best possible experience for everyone who gives it a chance
There’s still plenty ahead of us, and going live is really just the beginning
Proud of the team
Proud of what we’ve built
Now it’s time to Maxx it
From day one, @maxxedio will support the crypto space
The creators grinding in the trenches. The traders chasing the next move. The investors backing what they believe in. The meme communities driving internet culture.
Crypto is more than charts. It’s the people behind them. Maxxed is being built as a place where crypto feels at home, a platform where you can switch off, enjoy yourself, and trust the experience.
If you’re in crypto, you’ll always have a place here.
One thing I've learned over the years:
The people closest to the problem usually have the best solutions. That's why we're spending less time guessing what people want and more time listening to the conversations happening around gambling and crypto, and to the communities that bring them together.
Some of the things we're building today started as simple comments, ideas, or frustrations shared by others. We’re not just creating @maxxedio for the community, but we’re shaping it alongside them.
Drop your best suggestion below for a chance to win $50.
Reading stories like this only reinforces our vision.
At @maxxedio, we're building around one simple idea: treat players the way we'd expect to be treated ourselves, especially those who trust us the most.
We're just a few months away from seeing it for yourself.
I have wagered over $300M on online casinos and have never experienced anything like this.
Last month, I signed up to @dopexyz and deposited $30,000, which I lost. I claimed my lossback and returned earlier this month with another $40,000 deposit.
I played the same way I had initially played, eventually dropping to around $5,000 before turning it around to nearly $100,000 and attempting to withdraw.
That is when the problems began.
My VIP host, Rob, was the only person who consistently tried to help. I was told my account had been flagged for AML because of my betting pattern and wager volume. This was confusing, considering the exact same activity had apparently been completely fine when I was losing.
I was told the relevant department had been contacted and that the issue was being escalated. I was then directed to live support, which was initially unavailable. When it finally became available, an agent named Preston responded once, said they would investigate, and then stopped replying entirely.
I have contacted live support repeatedly. My messages have been left on read and ignored for days. Friends contacted the same support channel and received immediate responses, so this does not appear to be a general support issue.
The situation became even worse when I cancelled and attempted to split my withdrawals. The funds were not returned to my balance, leaving close to six figures effectively unavailable for days.
It has now been almost two weeks without a withdrawal, a clear explanation, or a final resolution.
The explanations have also continually changed:
• First, I was told I had been flagged for AML due to insufficient wagering.
• Then I was told Pragmatic had flagged my account.
• I was told Pragmatic would respond to resolve the issue.
• Nearly two weeks later, I am apparently still waiting for that response.
For clarity: I categorically deny multi-accounting, bonus abuse, or any similar conduct. This is my only account. I have wagered approximately $385,000 against $70,000 in deposits—more than 5x my deposits in wagering.
I have tried every private channel available to me. I have been patient, cooperative, and have given the operator ample time to resolve this privately.
I did not want to go public because I believe @dopexyz is a relatively new operator and I would prefer to see them succeed. But at this point, I need a clear explanation and access to my funds.
@dopexyz — please resolve this publicly or privately. I am happy to provide any information required to verify my account and activity.
I hope the team does the right thing and resolves this fairly.
I wanted to share something from behind the scenes.
These are some of the very first sketches we created with one of the industry's leading design firms while bringing Maxxed to life.
We did not want to communicate like every other casino. So we created Maxx: a character built around the energy, humor, and culture of the gambling timeline.
One thing we've realized while building @maxxedio
It's never been easier to launch a casino. The modern tech, the games, and the bonuses are there. If you wanted to, you could launch something that looks very similar to everyone else in a matter of weeks.
But when I think about the best moments I've had in gambling over the years, I don't remember the bonus percentages or how many games a site had. I remember the people behind it. The communities that formed around it, the chats that never slept, the memes, the inside jokes, and the feeling of being part of something while it was still early.
Somewhere along the way, the industry became very good at building casinos and forgot how important the people around them actually are.
That's what we want Maxxed to be remembered for.
